CVE-2026-100665
Received Received - Intake

Netty QUIC Hostname Verification Bypass via Incomplete Fix

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint identification from running even when HTTPS verification is configured. Attackers on the network path can present a certificate chain for the wrong hostname that the plain trust manager accepts, bypassing hostname authentication for QUIC clients.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100665
EUVD
EUVD-2026-87759

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
netty netty to 4.2.18.final (exc)
netty netty From 4.2.11 (inc) to 4.2.18 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100665 is a hostname verification bypass vulnerability in Netty's QUIC client implementation. It affects versions 4.2.11.Final to 4.2.17 of io.netty:netty-codec-classes-quic. The issue occurs when using a plain X509TrustManager, which causes the QUIC certificate verification path to ignore hostname verification even when explicitly enabled. Attackers on the network path can exploit this to present a certificate for a different hostname, bypassing authentication.

Detection Guidance

To detect this vulnerability, check if your system uses Netty versions 4.2.11.Final through 4.2.17. Run commands like 'find / -name netty*.jar' or 'mvn dependency:tree' in your project directory to identify affected versions. If using QUIC clients with plain X509TrustManager, verify if hostname verification is properly configured.

Impact Analysis

This vulnerability allows attackers to perform man-in-the-middle attacks by impersonating servers. QUIC clients using plain X509TrustManager may connect to malicious servers without detecting the mismatch in hostnames. This could lead to data interception, unauthorized access, or exposure of sensitive information transmitted over QUIC connections.

Mitigation Strategies

Upgrade Netty to version 4.2.18.Final or later immediately. If upgrading is not possible, avoid using plain X509TrustManager in QUIC clients and ensure endpoint identification is explicitly enabled via QuicSslContextBuilder.forClient().endpointIdentificationAlgorithm("HTTPS").

Review and update trust manager configurations to use X509ExtendedTrustManager instead of plain X509TrustManager to preserve hostname verification functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100665. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart